Sensitive Information Exposure in Apache Syncope by Apache Software Foundation

CVE-2026-87779

What is CVE-2026-87779?

A vulnerability exists in Apache Syncope allowing for the insertion of sensitive information into log files. Specifically, when an AES key of a non-standard length is configured, the system pads the provided key with random characters, leading to potential logging of confidential data. This issue affects multiple versions of Apache Syncope, specifically from 3.0.15 to 3.0.16 and from 4.0.3 to 4.0.7, as well as versions 4.1.0-M0 through 4.1.2. Users should immediately upgrade to versions 4.0.8 or 4.1.3 to address this security concern.

References